$since = (Get-Date).AddHours(-24)

Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 4663, 4656, 4660
StartTime = $since
} -ErrorAction SilentlyContinue |
ForEach-Object {
$event = $_
[xml]$xml = $event.ToXml()
$data = @{}

foreach ($item in $xml.Event.EventData.Data) {
$data[$item.Name] = $item.'#text'
}

if ($data.ObjectName -like "*Desktop*") {
[PSCustomObject]@{
Time = $event.TimeCreated
EventID = $event.Id
File = $data.ObjectName
AccessMask = $data.AccessMask
Process = $data.ProcessName
User = $data.SubjectUserName
}
}
} | Format-List